Hacker News Reader

Comment by chrischen | Hacker News Reader

> To be clear, when you clear your cookies in your browser, it can make parts of your experience worse. You may have to sign back in to every website, and you may have to reconfigure things. The same will be true here. Your Facebook won't be as good while it relearns your preferences.

Sounds like they designed this feature explicitly to show people why they need to provide facebook data. Instead of designing facebook features so that they can enjoyed while preserving privacy, Facebook is making moves to explicitly show how on Facebook privacy is at odds with utilitarianism of their product.

View on HN

> Sounds like they designed this feature explicitly to show people why they need to provide facebook data. Facebook is making moves to explicitly show how on Facebook privacy is at odds with utilitarianism of their product.

In all seriousness, how is that possible any other way? Take the example he gives about log in. If you want a website to automatically know who you are without logging in, please let me know how that is possible without automatically sending identifying information to the website.

There's not logging in automatically, and then there's using other data they have about you (however limited) to still provide a good experience. The parent comment is clearly talking about the latter (creating experiences that are equally good for privacy minded and open book people) while you're focused on a small feature that isn't really relevant to the bigger picture.

Yes, to offer that functionality it would need a cookie. No, the website doesn't need to correlate that login and all activity related to it to everything else you ever did on the internet to build up a profile about you. It is technically feasible (even easier) to offer the first ("remember me on this one site") without doing the second ("track me across all sites").

Well, technically it's all the same, it's a request to FB servers with an user id and token. Decoupling that relies entirely on Facebook's internal policy. Since they are a public company now, not using that dsta is leaving money on the table.

Technically, at least for EU users, whether they do this or not should now be a switch on the GDPR panel.

Not using that data also makes the ads expierence for people significantly worse.

And I prefer seeing good ads over bad ones

Yea!? How the hell can a website provide easy automatic login without storing your last 10 years of browsing history , every personal covertion you ever had and reselling that information to third parties that use it to track you political affiliations so they can manipulate you during elections!!?!?!! Do these people even know how cookies work? /s

Privacy and usability are not orthogonal, though Facebook will definitely go leaps and bounds beyond themselves to try to convince the public that it is so.

You're conflating the analogy with what the analogy was about. They didn't say that ten years of browser history was needed for automatic login.

Privacy and usability actually are orthogonal, as the cookie and login issue shows. You will see this again and again in almost every service. People can't offer loans without knowing credit history. Games can't do balanced matchmaking systems without learning about your level of skill. A website can't send you emails unless you give them your email. I could go on, but I think you are upset enough with Facebook that you won't get the point.

Sorry to be "that guy", but just responding because I was confused by your post and the parent's post, because you are both using "orthogonal" to mean the opposite of what it actually means. If two things are orthogonal, it means they are independent of each other, i.e. changing one has no effect on the other.

> and you may have to reconfigure things

Too bad Facebook couldn't figure out a way to remember I prefer a chronological news feed even with cookies.

How do you judge how "good" Facebook is, in order to evaluate this? I'm having a hard time thinking people will notice either way.

There probably will be a difference, but I think in actual use, for most people, it will be very small.

I can see it having to do with the ordering of timeline events, the ads you see, and the news visible in the top right corner.

Yes, it would make a difference there. My question is in regards to the top-level comment, will people notice the difference?

For example: If my mother "cleared her history", I really doubt she would notice the worse quality of Facebook and regret deleting her data, as the top-level comment implied. So my point is it's not a move to show how effective the algorithms are, but a privacy-conscious one from Facebook.

I don't know... personally my Facebook experience improved dramatically after I deleted my account in 2013 :)

They'll do what Google does, and impose barely-justified punishments on any users who try to deviate from their preferred flow.

Wouldn't GDPR say that user experience shouldn't be dependent on the consent given by the user?

I don't know how this could be universally possible. If you don't consent to providing data that is key to enabling features of the experience, how could that experience be provided?

Surely there are many areas of functionality that depend upon gaining GDPR consent?

Trivial example: I can't email you if you withhold email consent.

Actually, I can. If you’ve given me your email for some business reason, and for me to conduct that business I need to email you, I can email you. Even if you didn’t explicitly give consent.

What I can’t do is email you marketing newsletters the times a week for the next decade, or sell your email address to ‘specially selected trusted partners’.

Do you know which parts of GDPR specify the concrete limits on things like this? Or is it more a “I’ll know it when I see it” kind of fuzzy boundary for what’s allowed? Would be helpful to know!

"You must balance your interests against the individual’s. If they would not reasonably expect the processing, or if it would cause unjustified harm, their interests are likely to override your legitimate interests."

https://ico.org.uk/for-organisations/guide-to-the-general-da...

well article 6 is as concrete as it gets:

https://gdpr-info.eu/art-6-gdpr/

(and maybe article 9) https://gdpr-info.eu/art-9-gdpr/

To be even more precise, you can refer to Article 6, section f) about Legitimate interests.

If you conduct business with an individual, most of time, your legal basis will be the Legitimate interests of both parties, you should only rely on consent for non-necessary part/service (like subscribing to a newsletter, or sharing information for improving the service).

For a good summary of that, I would recommand this ICO document: https://ico.org.uk/media/about-the-ico/consultations/2013551...

As you say, the boundaries are fuzzy. The more data (especially sensitive data) that you collect and process, the tighter you need to make your boundaries.

Most of the advice I've received is to focus on documenting what data you hold, and what you're doing with it. Just by doing that, you'll probably improve your processes. If you did have any problems with the ICO, those documents will go a long way to showing that you took GDPR seriously.

My, perhaps unfair, impression of GDPR is that it has very little concrete and specific rules, and a whole lot of "you'll know when the court delivers the verdict".

My impression is that GDPR is actually pretty clear, but people involved in PI processing business have a strong cognitive dissonance about it. It's GDPR telling them "don't do that", vs. them thinking "I must do that, so GDPR is unclear on how can I do that".

GDPR is very specific. You must have written policies describing what you do with data, what you do if there’s a breach, how people can find out what data you hold, how people can have their data deleted. And you must have consent to contact someone unsolicited. If you don’t have consent you must have legitimate interest. Legitimate interest includes the words “reasonably expect” but that’s pretty standard for laws.

The GDPR isn't about concrete limits, but concrete permissions. A lot of people have been struggling to make sense of this, because it totally inverts how we currently think about personal data.

The collection, storage and processing of personal data is presumed to be unlawful by default, unless it is for a specific, explicit and legitimate purpose. These core principles are set out in Article 5 and they are well worth reading and reflecting on.

https://gdpr-info.eu/art-5-gdpr/

Did the user give you explicit and informed consent for a specific use a specific piece of data? Is your use of data absolutely essential to fulfil your contractual obligations to that user? Are you required by law to collect and store that data? Is your use of data essential to preserve human life? If you can't confidently say yes to at least one of those questions, then you're probably in breach.

You can check whether it not it does if you're interested - it's been published. I can't be bothered to check but I'd be very surprised if they tried to dictate functionality.

I think the intent there would be that you can't intentionally degrade unrelated parts of the service. For example, if Facebook disabled your ability to view or upload photos because you wouldn't consent to sharing your location.

It would be unreasonable of anyone to expect to see location-based content if they'd opted out of location sharing.

> Your Facebook won't be as good while it relearns your preferences.

This is an excellent feature. I replaced Facebook time with Twitter time a while back and found it even more addicting (because the talent pool is much better and more real-time, and there's an extra sunk-cost fallacy going on with the amount of work required to find good content).

But even more recently, I've been purposefully logging out of Twitter a lot more (and have replaced that with YouTube). Logging back into Twitter now, I see that the "content" there feels less relevant and more boring. This is great for productivity. I just gotta curb the YouTube now - at least with that I can just shunt everything to "Watch Later".

Alright, time to log out of hacker news too.

Sounds a lot like "guys, you should NEVER delete cookies or the world would crumble."

It's exactly what Zuckerberg added as a disclaimer if you were to choose to use their new feature.

I wonder if and how this impacts their ad targeting abilities?

If people use it en-masse, probably negatively, but most likely they're betting few people will use it, just like how few people (almost no one I know) 100% go through with account deletion. The reality is there is no compromise for privacy. They build tools that help you either lose all value from facebook and retain your privacy, or relinquish your privacy to continue using facebook. It's not so much privacy forward tooling as it is a constant reminder they have a gun to your head.

Thanks for the reply. Instapainting looks like a great service btw.

Well, GDPR makes forces them to make the tracking features opt in, so they have to collectively convince EU users to turn on the tracking as opposed to hoping the people won't disable it.

They do this through a few devious practices, such as the spin doctoring discussed here. One other thing that they do is instead of the option being a check box, it is a selection between two radio buttons and you explicitly have to choose one of them. I suppose this is actually a violation of the GDPR, since it should be disabled by default.

You don't lose value from facebook at all by not opting in. "Show ads that are relevant to me," is an arrogant statement. The actual statement is "Track my browsing to show ads that Facebook believes are relevant to me." I don't use Facebook for the targeted ads, I use it to infrequently receive news about people I know spread out across the globe.

What difference does it make? They wouldn't lower their rates and a zillion people are still on FB so advertisers are going to buy the slots regardless. "Ad targeting" is not something that people outside of the niche of advertising economics care about.

Well, I understand that Facebook will try to extract as much value from advertisers as possible as well, testing the price they're willing to pay based on the conversions that advertiser hopefully are tracking accurately.

I more was curious of whether the history cleared with Clear History are primary markers for ad targeting or if other data is used, and in reality if enough users don't clear their data but have similar data fingerprints (the non-Clear History data) then Facebook could still present assumptions to target by for those who do clear their history regularly, e.g. it will be a moot point up until say 40% of people regularly are clearing their history and therefore can no longer accurately enough make those assumptions.

wonder if and how this impacts their ad targeting abilities?

Not at all, the NN that does ad targeting has already been trained on the data. Deleting it will make no difference (assuming you believe they actually will delete it)

Reply on news.ycombinator.com